Privacy Policy

At Lionel X ("we," "our," or "us"), we are committed to protecting your privacy and ensuring the security of your data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application (the "App").

Please read this privacy policy carefully. If you do not agree with the terms of this privacy policy, please do not access the App.

1. Information We Collect

1.1 Personal Information

We collect the following personal information when you create an account:

• Email Address: Used for account authentication and secure communication.
• Display Name (Callsign): Your chosen username displayed on dashboards.
• Avatar Initials: Generated from your display name for profile identification.
• Verification Code: Used during registration to verify physical book ownership or access rights.

1.2 Health and Fitness Data

We integrate with Apple HealthKit and Google Health Connect to track your fitness progress. We read step count, distance, and active calories so we can show daily progress. On Android we may also write step and distance samples that the app measured with the on-device pedometer, so Health Connect stays in sync with your walking activity. We do not write medical data, heart rate, weight, sleep, or other unrelated health records.

Data Type	Permission	Purpose
Step Count	READ and WRITE	Read daily steps and write pedometer-measured steps back to Health Connect
Distance	READ and WRITE	Read walking distance and write measured distance back to Health Connect
Active Calories	READ	Show calories burned during activity
Health data history	READ	Backfill past step and distance days after you connect Health Connect

What we DO NOT access:

• ❌ Heart rate data
• ❌ Weight or body measurements
• ❌ Sleep data
• ❌ Heart rate, sleep, weight, or other medical data types

1.3 Activity Recognition

We use your device's motion sensors (accelerometer) to count steps in real-time when the app is running. This enables accurate step tracking even when Health Connect/HealthKit data is unavailable.

1.4 Location Data (Foreground Active Sessions Only)

We collect precise location data only when you explicitly start an "Active Session" tracking feature:

• GPS Coordinates: Collected in real-time to map your walking route and calculate distance.
• Foreground Only: Location tracking pauses automatically when you switch to another app or lock your screen. Tracking resumes when you return to the app.
• No Background Location: We do NOT track your location in the background. Your privacy is protected when the app is not in active use.
• User Control: You can disable location permissions at any time in your device settings.

1.5 Usage and Device Data

• App Activity: Leaderboard interactions, protocol task completions, audiobook progress.
• Streak Data: Current streak, longest streak, and daily target achievements.
• Device Information: Device type, OS version (Android/iOS), and app version.
• Push Notification Tokens: Device tokens for sending reminders (if enabled).

2. Android Permissions Summary

Here is a complete list of permissions requested by Lionel X on Android:

Permission	Why We Need It
ACTIVITY_RECOGNITION	Count steps using your device's motion sensors
health.READ_STEPS / health.WRITE_STEPS	Read and write step count with Health Connect
health.READ_DISTANCE / health.WRITE_DISTANCE	Read and write walking distance with Health Connect
health.READ_ACTIVE_CALORIES_BURNED	Read calories burned from Health Connect
health.READ_HEALTH_DATA_HISTORY	Read older step and distance history for backfill
ACCESS_FINE_LOCATION	GPS tracking during Active Sessions (foreground only)
ACCESS_COARSE_LOCATION	Approximate location for GPS features
FOREGROUND_SERVICE	Keep step counting running while using other apps
POST_NOTIFICATIONS	Send reminders and achievement notifications
INTERNET	Sync data with our servers
REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	Prevent Android from stopping step counting

Permissions we DO NOT request:

• ❌ ACCESS_BACKGROUND_LOCATION - We never track you in the background
• ❌ Medical or unrelated health WRITE types (heart rate, weight, sleep, glucose, etc.)
• ❌ Camera, microphone, or contacts access

3. Data Retention Policy

We enforce strict data retention limits to minimize your digital footprint:

• Location Data (GPS): Retained for 90 days. Detailed GPS route data is automatically deleted from our servers 90 days after the session is created.
• Step History: Indefinite Retention. Daily summaries (e.g., "Jan 12: 10,500 steps") are kept indefinitely to maintain your streak history and lifetime stats, unless you delete your account.
• Account Data: Retained until you request account deletion. Upon deletion, data is removed immediately.

4. How We Share Your Information

4.1 Third-Party Service Providers

We use trusted third-party infrastructure to operate our app. These providers are authorized data processors:

• Lovable Cloud / Supabase (Backend & Database): We use Lovable Cloud and Supabase as our primary backend infrastructure to store user profiles, step summaries, and authentication data. All data is encrypted at rest and in transit.
• Firebase Cloud Messaging (Notifications): We use Google Firebase solely for delivering push notifications (e.g., "Target Hit" or "Streak Reminder"). We do not use Firebase for analytics or advertising tracking.
• Google Health Connect / Apple HealthKit: We interface with these services to read step counts, distance, and calories, and on Android we may write step and distance samples the app measured so your Health Connect history stays consistent.

4.2 Public Leaderboards (Opt-In)

If you enable leaderboard visibility, the following is visible to other users:

• Display Name (Callsign)
• Total Step Count
• Global Rank

Note: You can hide yourself from leaderboards instantly in Profile → Privacy & Security.

4.3 What We DO NOT Do

• ❌ We DO NOT sell your personal data.
• ❌ We DO NOT share GPS location history with advertisers.
• ❌ We DO NOT use your data for marketing purposes outside of app functionality.
• ❌ We DO NOT track your location when the app is in the background.

5. Data Security

We implement enterprise-grade security measures:

• Encryption: All data is encrypted in transit (TLS 1.3) and at rest (AES-256).
• Secure Authentication: Passwords are never stored in plain text; they are hashed using industry-standard algorithms.
• Access Control: Strict role-based access limits internal access to your data.

6. Your Rights (GDPR & CCPA)

Under the GDPR and CCPA, you have specific rights regarding your data:

• Right to Access: Request a copy of all data we hold about you (JSON export).
• Right to Rectification: Correct inaccurate profile data directly in the app.
• Right to Erasure: Request permanent deletion of your account.
• Right to Restrict Processing: Disable location tracking or leaderboard participation.

7. Data Deletion & Account Management

You have the right to request deletion of your account and all associated data at any time.

How to Request Account Deletion:

• In-App (Instant): Open Lionel X → Profile → Privacy & Security → Delete Account. This action is immediate.
• Email Request: Contact us at info@outstandr.com with the subject "Delete My Account".

What Happens When You Delete:

• Profile and authentication credentials are wiped.
• All step history and streak records are permanently removed.
• You are removed from all leaderboards.
• Backup Retention: Residual data in encrypted backups may remain for up to 30 days before being overwritten.

Data Export (Before Deletion):

You can export your data before deletion:

• Open Lionel X app → Profile → Privacy & Security → Export Data
• Your data will be downloaded as a JSON file including profile, steps, sessions, and bookmarks.

8. Children's Privacy

Lionel X is not intended for children under the age of 13. We do not knowingly collect information from children. If we discover such data, we will delete it immediately.

9. Links to Other Websites

Our Service may contain links to other websites, including our Masterclass landing page, that are not operated by us. If you click on a third-party link, you will be directed to that third party's site. We strongly advise you to review the Privacy Policy of every site you visit.

We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services.

10. Contact & Organization Details